Listing of the Claims; 



Claims 1-9 (Canceled). 



Claim 10 (Previously Presented): A shared secret reconstruction apparatus for 
reconstructing a secret, used for a case where n first shares are generated from original 
secret information, n being an integer equal to or greater than two, by using a first 
threshold secret sharing scheme, in which the original secret information can be 
reconstructed by a collection of at least any k members from a group having n members 
(2 < k < n), and the n shares are distributed to the n members, t members collected from 
the n members separately possessing the shared secret reconstruction apparatus, t being 
an integer equal to or greater than k, the shared secret reconstruction apparatus thus 
operating together with t - 1 other shared secret reconstruction apparatuses, the shared 
secret reconstruction apparatus comprising: 

a secret sharing operation unit, when t members are collected from the n 
members, generating second shares from a first share held by the shared secret 
reconstruction apparatus by using a (t, t) threshold secret sharing scheme, in which 
original secret information can be reconstructed by a collection of t members from the 
collected t members, and distributing the second shares to the t shared secret 
reconstruction apparatuses of the collected t members including itself; and 

a secret reconstruction operation unit calculating an intermediate result for 
reconstructing the original secret information in a distributed computation by use of the 
output from the secret sharing operation unit and the second shares received from the t - 
1 other shared secret reconstruction apparatuses and transmitting the intermediate result; 
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wherein the secret sharing operation unit generates third shares from member ID 
held by the shared secret reconstruction apparatus by using a secret sharing scheme and 
distributes them to the t - 1 other shared secret reconstruction apparatuses, the secret 
reconstruction operation unit thereby calculating an intermediate result for the secret 
reconstruction in the distributed computation by use of the second and third shares output 
from the secret sharing operation unit and received from the t - 1 other shared secret 
reconstruction apparatuses; 

wherein the secret reconstruction operation unit comprises: 

a term calculation unit performing a distributed multiplication on the result of a 
distributed computation performed on a coefficient calculated from the third share to the 
second share and on this second share by use of the second and third shares output from 
the secret sharing operation unit and received from the t - 1 other shared secret 
reconstruction apparatuses; and 

an adder summing all the outputs from the term calculation unit; and 

wherein the term calculation unit comprises: 

a difference operation unit calculating differences between the different third 

shares; 

a first multiple term distributed multiplication unit performing a distributed 
multiplication on the outputs from the difference operation unit; 

a distributed inverse element calculation unit performing a distributed 
computation on the inverse element of the output from the first multiple term distributed 
multiplication unit; 



-3- 



(10/798,578) 



a second multiple term distributed multiplication unit performing a distributed 
multiplication on the third shares; and 

a pair of two term distributed multiplication units performing a distributed 
multiplication on the output from the distributed inverse element calculation unit, the 
output from the second multiple term distributed multiplication unit and the 
corresponding second share. 

Claim 1 1 (Canceled). 

Claim 12 (Original: The shared secret reconstruction apparatus of claim 10, further 
comprising a secret reconstruction unit reconstructing the original secret information 
from the output from the secret reconstruction operation unit and the outputs received 
from the t - 1 other shared secret reconstruction apparatuses. 

Claim 13 (Previously Presented): The shared secret reconstruction apparatus of claim 10, 
wherein the second secret sharing scheme generates shares in such a way that the original 
secret information is a sum of all the shares. 

Claim 14 (Original): The shared secret reconstruction apparatus of claim 10, wherein the 
secret reconstruction operation unit comprises an adder summing the output from the 
secret sharing operation unit and the second shares received from the t - 1 other shared 
secret reconstruction apparatuses. 
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Claim 15 (Original): The shared secret reconstruction apparatus of claim 10, wherein the 
secret sharing operation unit uses a threshold secret sharing scheme using member IDs. 

Claim 16 (Previously Presented): The shared secret reconstruction apparatus of claim 10, 
wherein the secret reconstruction operation unit comprises a linear combination operation 
unit performing a linear combination operation on the output from the secret sharing 
operation unit and the second shares received from the t - 1 other shared secret 
reconstruction apparatuses using coefficients calculated from member IDs, the second 
shares being received via secure channels. 

Claim 17 (Original): The shared secret reconstruction apparatus of claim 10, wherein the 
secret sharing operation unit uses a threshold secret sharing scheme using temporary 
member IDs distributed to the shared secret reconstruction apparatus. 

Claims 18-20 (Canceled). 

Claim 21 (Previously Presented): The shared secret reconstruction apparatus of claim 
10, wherein each of the first and second multiple term distributed multiplication units 
comprises a number of two term distributed multiplication units each performing a 
distributed multiplication on two values, the number being one less than the number of 
values on which the distributed multiplication is performed. 
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Claim 22 (Original): The shared secret reconstruction apparatus of claim 21, wherein 
each of the two term distributed multiplication units comprises: 
a multiplication unit multiplying two inputs; 

a secret sharing unit generating fourth shares from the output from the 
multiplication unit by using a threshold secret sharing scheme using temporary member 
IDs and distributing them to the t - 1 other shared secret reconstruction apparatuses via 
secure channels; and 

a linear combination operation unit performing a linear combination operation 
on the output from the secret sharing unit and the fourth shares received from the t - 1 
other shared secret reconstruction apparatuses, using coefficients calculated from the 
temporary member IDs via the secure channels. 

Claim 23 (Previously Presented): The shared secret reconstruction apparatus of claim 21. 
wherein each of the two term distributed multiplication units comprises: 

a first multiplication units each multiplying two inputs together and then 
multiplying the product by a coefficient calculated from temporary member IDs; 

first communication operation units each multiplying a first input to itself and a 
second input to a corresponding term distributed multiplication unit in another shared 
secret reconstruction apparatus by performing an oblivious transfer via secure channels; 

second communication operation units each multiplying a second input to itself 
and a first input to a corresponding term distributed multiplication unit in another shared 
secret reconstruction apparatus by performing an oblivious transfer via secure channels; 
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first adders each summing the outputs from the first and second communication 
operation units; 

second multiplication units each multiplying the output from one of the first 
adders by a coefficient calculated from temporary member IDs; and 

a second adder summing all the results of the first and second multiplication 

units. 

Claim 24 (Previously Presented): The shared secret reconstruction apparatus of claim 21, 
wherein each of the two term distributed multiplication unit comprises: 

a first multiplication unit multiplying first and second inputs to itself; 

first communication operation units each multiplying the first input to itself and 
a second input to a corresponding term distributed multiplication unit in another shared 
secret reconstruction apparatuses by performing an oblivious transfer via secure channels; 

second communication operation units each multiplying the second input to 
itself and a first input to a corresponding term distributed multiplication unit in another 
shared secret reconstruction apparatus by performing an oblivious transfer via the secure 
channels; 

first adders each summing the outputs from the first and second communication 
operation units; and 

a second adder summing all the results of the first multiplication unit and the 
first adders. 
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Claim 25 (Previously Presented): The shared secret reconstruction apparatus of claim 
10, wherein the distributed inverse element calculation unit comprises: 

a number of distributed multiplication units performing a distributed 
multiplication on two values, the number being calculated from a size of a finite field 
used in the distributed multiplication; and 

a multiple term distributed multiplication unit performing distributed 
multiplication on a number of values calculated from the size of the finite field used in 
the distributed multiplication, the multiple term distributed multiplication unit including a 
number of two term distributed multiplication unit performing a distributed multiplication 
on two values, the number of the two term distributed multiplication unit being one less 
than the number of values on which the distributed multiplication is performed. 

Claim 26 (Previously Presented): The shared secret reconstruction apparatus of claim 10, 
wherein the distributed inverse element calculation unit comprises: 

a random number generation unit generating a random number; 

a first two term distributed multiplication unit performing a distributed 
multiplication on a first value and the output from the random number generation unit; 

a linear combination operation unit performing a linear combination operation 
on the output from the first two term distributed multiplication unit and output received 
from the corresponding two term distributed multiplication unit in the t - 1 other shared 
secret reconstruction apparatuses, using coefficients calculated from temporary member 
IDs, the output being received via a secure channel; 
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an inverse element operation unit calculating the inverse element of the output 
from the linear combination operation unit in finite field; 

a secret sharing unit generating fifth shares from the output from the inverse 
element operation unit and distributing them to the t - 1 other shared secret 
reconstruction apparatuses via secure channels; and 

a second two term distributed multiplication unit receiving the fifth share from 
the secret sharing unit and the output from the random number generation unit as inputs 
and having the same structure as the first two term distributed multiplication unit. 

Claim 27 (Previously Presented): The shared secret reconstruction apparatus of claim 10, 
wherein the distributed inverse element calculation unit comprises: 

a random number generation unit generating a random number; 

a first two term distributed multiplication unit performing a distributed 
multiplication on a first value and the output from the random number generation unit; 

an adder summing the output from the first two term distributed multiplication 
unit and the outputs received from the corresponding first two term distributed 
multiplication unit in the t - 1 other shared secret reconstruction apparatuses, the outputs 
being received via secure channels; 

an inverse element operation unit calculating the inverse element of the output 
from the adder in finite field; 

a secret sharing unit generating fifth shares from the output from the inverse 
element operation unit and distributing them to the t - 1 other shared secret 
reconstruction apparatuses via secure channels; and 
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a second two term distributed multiplication unit receiving the fifth share from 
the secret sharing unit and the output from the random number generation unit as inputs 
and having the same structure as the first two term distributed multiplication unit. 

Claim 28 (Previously Presented): The shared secret reconstruction apparatus of claim 10, 
wherein the distributed inverse element calculation unit comprises: 

a random number generation unit generating a random number; 

a first two term distributed multiplication unit performing a distributed 
multiplication on a first value and the output from the random number generation unit; 

a transmission unit transmitting the result of the first two term distributed 
multiplication unit to a shared secret reconstruction apparatus; 

a receiving unit for receiving the fifth share from the shared secret 
reconstruction apparatus; and 

a second two term distributed multiplication unit performing a distributed 
multiplication on the received fifth share and the output from the random number 
generation unit. 

Claim 29. (Currently Amended) A secret reconstruction system for carrying out a secret 
reconstruction method for reconstructing a secret in a secret sharing scheme that generates 
n first shares from the secret information, n being an integer equal to or greater than two, 
the n shares being distributed to a group having n members in such a way that the original 
secret information can be reconstructed by a collection of any t members (2 < t < n), the 
secret reconstruction system comprising: a plurality of shared secret reconstruction 
apparatuses, wherein each shared secret reconstruction apparatus for reconstructing a 
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secret, used for a case where n first shares are generated from original secret information, n 
being an integer equal to or greater than two, by using a first threshold secret sharing 
scheme, in which the original secret information can be reconstructed by a collection of at 
least any k members from a group having n members (2 < t < n) (2 < k < n) , and the n 
shares are distributed to the n members, t members collected from the n members 
separately possessing the shared secret reconstruction apparatus, t being an integer equal to 
or greater than k, the shared secret reconstruction apparatus thus operating together with t - 
1 other shared secret reconstruction apparatuses, the shared secret reconstruction 
apparatus comprising: a secret sharing operation unit, when t members are collected 
from the n members, generating second shares from a first share held by the shared secret 
reconstruction apparatus by using a (t, t) threshold secret sharing scheme, in which 
original secret information can be reconstructed by a collection of t members from the 
collected t members, and distributing the second shares to the t shared secret 
reconstruction apparatuses of the collected t members including itself: and a secret 
reconstruction operation unit calculating an intermediate result for reconstructing the 
original secret information in a distributed computation by use of the output from the secret 
sharing operation unit and the second shares received from the t - 1 other shared secret 
reconstruction apparatuses and transmitting the intermediate result; wherein the secret 
sharing operation unit generates third shares from member ID held by the shared secret 
reconstruction apparatus by using a secret sharing scheme and distributes them to the 
t - 1 other shared secret reconstruction apparatuses, the secret reconstruction operation 
unit thereby calculating an intermediate result for the secret reconstruction in the 
distributed computation by use of the second and third shares output from the secret sharing 
operation unit and received from the t - 1 other shared secret reconstruction apparatuses; 
wherein the secret reconstruction operation unit comprises: a term calculation unit 
performing a distributed multiplication on the result of a distributed computation 
performed on a coefficient calculated from the third share to the second share and on this 
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second share by use of the second and third shares output from the secret sharing 
operation unit and received from the t - 1 other shared secret reconstruction apparatuses; 
and 

an adder summing all the outputs from the term calculation unit; and wherein the term 
calculation unit comprises: a difference operation unit calculating differences between the 
different third shares; 

a first multiple term distributed multiplication unit performing a distributed 
multiplication on the outputs from the difference operation unit; 

a distributed inverse element calculation unit performing a distributed computation on 
the inverse element of the output from the first multiple term distributed multiplication 
unit; a second multiple term distributed multiplication unit performing a distributed 
multiplication on the third shares; and 

a pair of two term distributed multiplication units performing a distributed multiplication 
on the output from the distributed inverse element calculation unit, the output from the 
second multiple term distributed multiplication unit and the corresponding second share; 
and 

a secret reconstruction apparatus reconstructing the original secret information from the 
outputs of the plurality of shared secret reconstruction apparatuses. 

Claim 30 (Original): The secret reconstruction system of claim 29, wherein the secret 
reconstruction apparatus is included in one of the plurality of shared secret reconstruction 
apparatuses. 
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Claim 3 1 (Original): The secret reconstruction system of claim 29, wherein the secret 
reconstruction apparatus reconstructs the original secret information by summing the 
outputs of all of the plurality of shared secret reconstruction apparatuses. 

Claim 32 (Original): The secret reconstruction system of claim 29, wherein the secret 
reconstruction apparatus reconstructs the original secret information by using a 
reconstruction method of a threshold secret sharing scheme using temporary member IDs. 

Claim 33 (Original): The secret reconstruction system of claim 29, further comprising a 
temporary member ID generation unit generating mutually distinct temporary member 
IDs to the shared secret reconstruction apparatuses operated by the collected members, 
and distributing and revealing them to the shared secret reconstruction apparatuses. 

Claim 34 (Original): The secret reconstruction system of claim 33, wherein the first 
shares are generated in such a way that the original secret information is a sum of all the 
first shares. 

Claim 35 (Original): The secret reconstruction system of claim 33, wherein the first 
shares are generated by using a threshold secret sharing scheme using member IDs. 
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